如何在Golang中为net.Conn添加socks5身份验证？

import (
    "net"
    "crypto/rand"
    "crypto/rsa"
    "crypto/tls"
    "crypto/x509"
    "encoding/pem"
    "io"
    "github.com/sergeyfrolov/gotunnel"
)

// 生成RSA密钥对
privateKey, _ := rsa.GenerateKey(rand.Reader, 2048)

// 创建证书模板
template := x509.Certificate{
    SerialNumber: big.NewInt(1),
    Subject: pkix.Name{
        Organization: []string{"Your Organization"},
    },
    NotBefore: time.Now(),
    NotAfter: time.Now().AddDate(10, 0, 0),
    KeyUsage: x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
    ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth},
    IPAddresses: []net.IP{net.ParseIP("127.0.0.1")},
}

// 使用模板创建证书
derBytes, _ := x509.CreateCertificate(rand.Reader, &template, &template, &privateKey.PublicKey, privateKey)

// 生成PEM编码的证书和私钥
certOut, _ := os.Create("cert.pem")
pem.Encode(certOut, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
certOut.Close()

keyOut, _ := os.Create("key.pem")
pem.Encode(keyOut, &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(privateKey)})
keyOut.Close()

// 实现socks5身份验证
func socks5Auth(conn net.Conn) bool {
    // 读取客户端的第一个字节，确定验证方法数量
    buf := make([]byte, 258)
    n, err := io.ReadAtLeast(conn, buf, 2)
    if err != nil {
        log.Println(err)
        return false
    }

    // 验证方法选择协商
    methods := buf[2:n]
    for _, m := range methods {
        if m == 0x00 {
            // 0x00代表无需验证，直接回复客户端
            conn.Write([]byte{0x05, 0x00})
            return true
        }
    }

    // 如果没有无需验证的方法，回复客户端拒绝身份验证
    conn.Write([]byte{0x05, 0xFF})
    return false
}

// 创建一个socks5服务器
server := gotunnel.NewServer()

// 设置TLS配置
cert, _ := tls.LoadX509KeyPair("cert.pem", "key.pem")
config := &tls.Config{
    Certificates: []tls.Certificate{cert},
}

// 监听本地地址
ln, _ := tls.Listen("tcp", "127.0.0.1:1080", config)

// 循环接受连接
for {
    conn, _ := ln.Accept()

    // 执行socks5身份验证
    if !socks5Auth(conn) {
        conn.Close()
        continue
    }

    // 将连接传递给socks5服务器处理
    go server.Handle(conn)
}